Ryfujk

I'm trying to setup a service account for FCM using Terraform. I created a custom role based on permissions in the Firebase IAM Permissions reference. I can't get it to work.

Here's my custom role (including auth permissions):

resource "google_project_iam_custom_role" "firebase_access" {

  project = "${data.google_project.firebase_project.id}"



  # https://firebase.google.com/docs/projects/iam/permissions

  permissions = [

    # Auth

    "firebaseauth.configs.get",

    "firebaseauth.configs.update",

    "firebaseauth.configs.create",

    "firebaseauth.users.create",

    "firebaseauth.users.createSession",

    "firebaseauth.users.delete",

    "firebaseauth.users.get",

    "firebaseauth.users.sendEmail",

    "firebaseauth.users.update",



    # Cloud Messaging

    "firebasenotifications.messages.create",

    "firebasenotifications.messages.delete",

    "firebasenotifications.messages.get",

    "firebasenotifications.messages.list",

    "firebasenotifications.messages.update",



    # Firebase required

    "firebaseanalytics.resources.googleAnalyticsReadAndAnalyze",

    "resourcemanager.projects.get",

    "resourcemanager.projects.getIamPolicy",

    # "resourcemanager.projects.list", Not required

    "servicemanagement.projectSettings.get",

    "serviceusage.apiKeys.get",

    "serviceusage.apiKeys.getProjectForKey",

    "serviceusage.apiKeys.list",

    "serviceusage.operations.get",

    "serviceusage.operations.list",

    "serviceusage.quotas.get",

    "serviceusage.services.get",

    "serviceusage.services.list",



  ]

  role_id = "[redacted]" # Can't have hyphens

  title = "Firebase [redacted] Role"

  description = "Provides the minimum permissions necessary for the [redacted] API to use Firebase"

}

I receive the below error:

Error: An error occurred when trying to authenticate to the FCM
servers. Make sure the credential used to authenticate this SDK has
the proper permissions. See
https://firebase.google.com/docs/admin/setup for setup instructions.

This is absolutely miserable. The error message isn't helpful at all. Checking a service account created via Firebase, I see there's an additional role, Firebase Admin SDK Administrator Service Agent. The role doesn't show up anywhere in documentation. I had to check out the HTTP request when adding the role to figure out its real name (roles/firebase.sdkAdminServiceAgent). Initially, I thought adding this role fixed my issue, but that was wrong. I had also added the Editor role, and GCP's IAM takes some time to update (-_-).

For now, I'm just going to add the Editor role, but I'd much prefer to constrain permissions as much as I possibly can.

What are the minimum permissions needed to sending FCM messages? The documentation is not helpful, as far as I can tell.

i'm having trouble with the same thing. Did you got to any other solution rather than adding the editor role? Because the editor role walks over firebase rules, so I can't use it.